Vulnerabilities

TI-2026-82891 CVE-2026-118541 · GHSA-p6j3-r2g3-f8vm

Access bypass in Drupal Commerce Core via forceful browsing

LOW 19

Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00193 Published 2026-10-30 Fixed in 2.41.0, 3.3.13 CWE-863

TI-2026-82892 CVE-2026-118542 · GHSA-65mh-qgf4-7wgx

LOW 13

Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00214 Published 2026-10-30 Fixed in 2.41.0, 3.3.13 CWE-863

TI-2026-82893 CVE-2026-118543 · GHSA-h38c-8g33-pr7c

LOW 29

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00158 Published 2026-10-30 Fixed in 2.41.0, 3.3.13 CWE-352

TI-2026-82894 CVE-2026-118544 · GHSA-v5mv-g539-3hqf

LOW 17

Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00197 Published 2026-10-30 Fixed in 2.41.0, 3.3.13 CWE-202